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LISTING OF THE CLAIMS : 

This listing of claims will replace all prior versions, and listings, of claims in the application: 

1 (Previously presented) A method for analyzing a potential cause of a change in a 
service, wherein service quality of the service is monitored, usage of the service is measured, and 
service events are detected, the method comprising: 

determining a service change time window based at least in part upon a change in service 
quality between a first working state and a second, non-working state, and upon a change in 
service usage amount, the service change time window encompassing at least part of a service 
outage; 

retrieving data representing a plurality of detected events and corresponding times in 
which the events occurred; 

computing a probability for each of the detected events that each of the detected events 
caused the service change based at least in part on a correlation between the event time and the 
service change time window; 

determining whether one or more other events of a type identical to one of the detected 
events occurred; and 

wherein computing the probability comprises computing the probability using at least in 
part a false occurrence weighting function which decreases the probability of the detected event 
as the cause of the service change for instances in which the detected event occurred outside the 
service change time window. 

2. (Original) The method of claim 1, wherein determining the service change time 
window comprises determining a service failure time window based upon the change in service 
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quality and narrowing the service failure time window to the service change time window based 

upon the service usage amount measured during that service failure time window. 

3. (Original) The method of claim 2, wherein the service quality is monitored through 
periodic polling of the service quality, and comprising determining the service failure time 
window as bounded by a polled point of the first working state and a polled point of the second, 
non- working state. 

4. (Original) The method of claim 1, wherein computing the probability comprises 
computing the probability using at least in part a time weighting function which decreases 
exponentially with the distance between the event time and the service change time window. 

5. (Cancelled) 

6. (Previously Presented) The method of claim 1, comprising storing historical data 
associating occurrences of prior events with prior service changes, and wherein computing the 
probability that one of the detected events caused the service change comprises computing the 
probability based at least in part on the historical data. 

7. (Original) The method of claim 6, wherein storing historical data comprises storing 
data representing instances in which prior events occurred within prior service change time 
windows, and wherein computing the probability that the detected event caused the service 
change comprises using at least in part a positive occurrence weighting function which increases 
the probability of the detected event as the cause of the service change based on instances in the 
historical data in which a prior event of a type identical to the detected event occurred within a 
prior service change time window. 

8. (Original) The method of claim 6, wherein storing historical data comprises storing 
data representing instances in which prior events were identified as having caused prior service 
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changes, and wherein computing the probability that the detected event caused the service 

change comprises using at least in part a historical weighting function which increases the 

probability of the detected event as the cause of the service change based on instances in the 

historical data in which a prior event of a type identical to the detected event was identified as 

having caused a prior service change. 

9. (Cancelled) 

10. (Previously presented) The method of claim 1, wherein computing probabilities 
comprises computing the probabilities such that the total of all computed probabilities is 1. 

1 1 . (Previously presented) The method of claim 1 , wherein the service comprises 
service over a communication network and wherein the detected events include a network event. 

12. (Previously presented) The method of claim 1, wherein the service comprises 
service provided by an application program and wherein the detected events include an 
application program event. 

13. (Original) The method of claim 1, wherein the service change is a service outage, 
comprising determining the service change time window as a change in service quality from the 
first working state to the second, non-working state. 

14 (Original) The method of claim 1, wherein the service change is a service recovery, 
comprising determining the service change time window as a change in service quality from the 
second, non-working state to the first, working state. 

15 (Original) The method of claim 1, wherein determining the service change time 
window comprises detecting a change in service quality by detecting a step change in measured 
usage. 
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16. (Previously presented) A method for analyzing potential causes of a service change, 
the method comprising: 

determining a service change time window encompassing a change of service between a 
first working state and a service outage, the service change being determined at least in part 
based on measured service usage levels; 

detecting occurrences of a set of events; 

retrieving data representing the plurality of detected events and corresponding times in 
which the events occurred, wherein the set of events are within a given time prior to and during 
the service change time window, each occurrence of an event being associated with a time at 
which the event occurred; and 

computing a probability distribution for the set of events, which probability distribution 
determines for each event in the set the probability that the detected event caused the service 
change, the probability distribution being based at least in part on relations between the time of 
each event occurrence and the service change time window; and 

wherein computing the probability includes using two or more second functions selected 
form the group consisting of: 

a time weighting function which decreases exponentially the probability of a given event 
as the cause of the service change with the distance between the given event time and the service 
change time window; 

a false occurrence weighting function which decreases the probability of a given event as 
the cause of the service change for instances in which events of the same type as the given event 
occurred outside the service change time window; 
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a positive occurrence weighting functions which increases the probability of a given 

event as the cause of the service change based on instances stored in a historical database in 

which events of the same type as the given event occurred within a prior service change time 

window; and 

a historical weighting function which increases the probability of a given event as the 
cause of the service change based instances in the historical database in which events of the same 
type as the given event were identified as having caused a prior service outage. 

17. (Original) The method of claim 16, wherein computing the probability distribution 
for the set of events comprises computing the probability distribution using a first weighting 
function which is the product of two or more second weighting functions. 

18. (Cancelled) 

19. (Original) The method of claim 18, wherein the step of computing the probability 
distribution comprises using a first weighting function which is the product of the time weighting 
function, false occurrence weighting function, positive occurrence weighting function, and user 
weighting function. 

20. (Original) The method of claim 16, comprising monitoring service quality, and 
wherein determining the service change time window comprises determining a service failure 
time window based upon a change in monitored service quality and narrowing the service failure 
time window to the service change time window based upon the service usage amount measured 
during that service failure time window. 

21 . (Original) The method of claim 20, wherein the service quality is monitored through 
periodic polling of the service quality, and comprising determining the service failure time 
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window as bounded by a polled point of the first working state and a polled point of the second, 

non- working state. 

22. (Original) The method of claim 16, comprising computing the probability 
distribution such that the total of all probabilities in the distribution is 1 . 

23. (Original) The method of claim 16, wherein the service comprises service over a 
communication network and wherein the detected events comprise network events. 

24 (Original) The method of claim 16, wherein the service comprises service provided 
by an application program and wherein the detected events comprise application program events. 

25 (Original) The method of claim 16, wherein the service change is a service outage, 
comprising determining the service change time window as a change in service from the first 
working state to the second, non-working state. 

26 (Original) The method of claim 16, wherein the service change is a service recovery, 
comprising determining the service change time window as a change in service from the second, 
non- working state to the first, working state. 

27 (Previously Presented) The method of claim 16, wherein determining the service 
change time window comprises detecting a step change in measured usage. 

Claims 28-77 Cancelled 
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